PRIVACY POLICY

With this document, we provide you with information on how Dopravní podnik města Hradce Králové, a.s. (hereinafter referred to as "DT") obtains and processes your personal data in connection with the provision of the SMS jízdenka service, when carrying out a ticket inspection, when providing contractual tour transport, when announcing and organizing public contracts, when sending newsletters, when recording lost and found items and in other of its normal business activities .

When processing personal data, we are governed by legal regulations, in particular Regulation of the European Parliament and of the Council of the EU 2016/679 of 27.4.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "EU Regulation"), which comes into effect on 25.5.2018.

This document will be updated periodically when the need arises for updating. The updated version of the Privacy Policy (hereinafter referred to as the "Policy") is effective upon publication on the www.dpmhk.cz website.

We protect your personal data to the maximum extent possible, which corresponds to the technical level of available means. Strict internal rules apply in DT determining which employees may have access to your personal data and to what extent they may process it, while access rights are narrowed down to the necessary minimum.

We encourage you to read this information carefully. We have done our best to make them as understandable as possible. If something is still not clear to you, we will be happy to explain any concept or passage to you. If you have any questions, please contact the contact person listed in section 1.2. below.

1. CONTROLLER OF YOUR DATA

The controller of your personal data is:

Dopravní podnik města Hradce Králové, a.s ., IČO: 25267213, registered office: Pouchovská 153/52, Věkoše, 500 03 Hradec Králové, registered in the Commercial Register kept by the Regional Court in Hradec Králové, Section B, Insert 1625.

Contact person and Data Protection Officer: GDPR Hradec s.r.o.,

with registered office: Fráni Šrámka 1139, 500 02 Hradec Králové, ID: 06708218, contact person: Mgr. Martin Jeřábek, e-mail: info@gdprhradec.cz, tel.: +420 495 510 765. 

The Controller collects your data, disposes of it and is responsible for its proper and lawful processing. You may exercise your rights against the controller in the manner set out below.

2. PROCESSED DATA, THEIR PURPOSE AND REASON

We process your personal data in the following processing methods and for the purposes listed below:

2.1. Provision of the Mobile Ticket (SMS) service

2.1.1. If you wish to use the Mobile SMS Ticket service, we process your telephone number, as it is not possible to use the Mobile Ticket service without a telephone.

Reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6 (1) (b) of the EU Regulation).

2.1.2. Since this service is technically provided by MATERNA Communications a.s., the telephone numbers from which mobile tickets were purchased are processed by this company, including the history of purchased mobile tickets. However, the Company does not have any other personal information about your identity besides your phone number. Data on purchased mobile tickets are processed for a period of 3 months in case you file a complaint and we can trace back the information needed to verify why the SMS ticket was not delivered to you. After the expiry of this period, the data is stored only for archiving purposes due to tax regulations, for the period required by applicable legislation.

2.1.3. If you complain about the Mobile Ticket service, we will record and require the following personal data about you due to the possibility of settling the complaint, until the complaint is settled and subsequently for a period of three years in the event of a possible dispute and the possibility of our subsequent defence:

• name and surname
• the phone number from which the disputed SMS was sent and the time of sending
• email
• contact phone number
• the result of the complaint procedure and mutual communication with you.

Reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6 (1) (f) of the EU Regulation).

2.2. Ticket inspection

2.2.1. If the inspector finds out that the transport contractual conditions have been breached, the inspector shall write out the Record of the performed transport inspection, which contains the following personal data:

• name and surname of the passenger
• date of birth
• delivery address
• information about the identity document (e.g. ISIC, ID card number)
• data on controlled driving (line, date, time, direction of travel)
• signature of the passenger.

Subsequently, these data are recorded by means of the document Report on breach of contractual transport conditions in the electronic system of DT – Ticket inspection.

Reason (legal basis) why we process the data:

- fulfillment of legal obligations - specifically according to the provisions. § 18a of Act No. 111/1994 Coll., on Road Transport and Act No. 266/1994 Coll., on Railways (we use this reason in accordance with Article 6 (1) (c) of the EU Regulation).

2.2.2. If the amount due is not paid, the above data are passed on to the contractual law firm for the purpose of subsequent recovery of the claim or these receivables are assigned to a third party. We do not transfer debtors' data to any public debtors' registers.

Reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6 (1) (f) of the EU Regulation).

2.2.3. If, on the basis of a transport inspection, the outstanding amount is subsequently paid before it is handed over for recovery to a third party, the personal data collected for these purposes are anonymised in electronic form within 2 months and shredded in paper form within the same period.

2.3. Contractual coaching

2.3.1. If you wish to use the services of a contractual tour service, we process the following personal data about you, which you provide to us by filling in the on-line form

to the www.dpmhk.cz "Order of tour transport":

• name and surname of the client
• VAT number in the case of a natural person doing business
• home address
• name and surname of the contact person
• telephone and e-mail of the contact person (an order confirmation is sent to the e-mail)
• details of the requested transport (date, destination, etc.).

By confirming the order, the Contract for the Provision of Coach Transport is concluded. These data are an essential part of every Contract for the provision of a tour and without their provision we would not be able to provide you with a tour service.

Reason (legal basis) why we process the data:

- performance of the concluded contract (we use this reason in accordance with Article 6 (1) (b) of the EU Regulation).

2.3.1. We also process data about our possible mutual communication related to the organization

and by providing tour transport, such as when dealing with your comments or when dealing with complaints, etc. In this communication, we process the following personal data that you provide to us:

• name and surname
• address of the complainant
• provided contact (e-mail or telephone)
• the reason and method of resolving the complaint.

Reason (legal basis) why we process the data:

- when dealing with complaints and claims, these are acts related to the performance of the concluded contract (we use this reason in accordance with Article 6 (1) (b) of the EU Regulation).

2.4. Announcement and administration of public tenders

2.4.1. If we are legally obliged to announce a public contract in accordance with the law

No. 134/2016 Coll., on Public Procurement or according to internal rules (small-scale contract), we process data on public contract participants and data provided within the bids of these participants, usually:

• data from the CVs provided by the members of the implementation team of the participant in the public contract (if this type of qualification is required),
• documents proving the education and qualifications of the members of the implementation team (if this type of qualification is required).

2.4.2. We are obliged to archive this personal data in accordance with a legal requirement for a period of

10 years after the end of the procurement procedure.

Reason (legal basis) why we process the data:

- fulfillment of legal obligations – specifically under Act No. 134/2016 Coll., on Public Procurement (we use this reason in accordance with Article 6 (1) (c) of the EU Regulation).

2.5. Sending the newsletter

Communication based on so-called legitimate interest without your consent

If you have used our services and have not objected to receiving newsletters, we are entitled in accordance with Art. 6 para. 1 point. f) EU Regulation (i.e. the legitimate interest of our company consisting in the possibility to use direct marketing) and in accordance with the provisions. § 7 para. 3 of Act No. 480/2004 Coll., on Certain Information Society Services, to send you commercial communications regarding our own identical or similar services to your e-mail provided without your prior consent. By commercial communication we mean only a newsletter containing news about changes in public transport, timetable changes or general information about changes in public transport operations; other types of marketing activities are not used by the Company .

However, we will not send you these commercial communications at all if you already make it clear when entering into a contractual relationship (participation in the event) that you do not want to send them. We will also not send you these communications if you have not used the services offered to our Company for more than 5 years.

You will also have the opportunity to refuse further sending of these newsletters within each e-mail you receive, where we will always explicitly notify you of this fact. At the same time, you will have a clear and distinct option to refuse further sending of these offers in a simple manner and free of charge (any form of response to the sent e-mail is sufficient, e.g. in the form of the text "DO NOT send").

Furthermore, we expressly draw your attention to your right to raise a so-called OBJECTION against the processing of your personal data on the grounds of the so-called legitimate interest of our Company in accordance with Article 21 of the EU Regulation. If you raise this objection to the processing of your personal data for direct marketing purposes (i.e. sending marketing communications without your consent) (you can use the prepared form ), this fact is also a reason that we will no longer send you the newsletter.

Communication on the basis of consent

If the conditions for sending newsletters without your consent are not met (but you have subscribed via the web form to receive the newsletter), we will only be able to send you the newsletter and process your e-mail address for this purpose with your prior consent. The text of the consent for sending the newsletter, as well as other conditions related to the granted consent, is available HERE.

We will start processing personal data (e-mail) only after you fill in your e-mail for sending the newsletter in the relevant web form, agree to the processing of this personal data and then activate and confirm the newsletter subscription according to the instructions contained in the delivered e-mail message. If the subscription to the newsletter is not confirmed according to the instructions contained in the delivered e-mail within 14 days, the entered e-mail will be liquidated without undue delay.

Granting consent is VOLUNTARY and you can revoke your consent at any time. The withdrawal of consent only has effect for the future and its withdrawal is therefore without prejudice to the lawfulness of the previous processing of personal data based on the consent granted.

If you do not give us your consent, the only consequence is that you will not receive information about the news. This fact has no influence on the quality of the services provided by the Company.

The legal basis for sending the newsletter in this case is therefore in accordance with Art. 6 para. 1 point. a) EU Regulation, your consent.

2.6. Form "Non-binding inquiry for advertising services"

If you make use of the possibility to contact us via the web contact form "Non-binding inquiry for advertising services", we collect the following data:

• name and surname
• email.

We will use this personal data only for the purpose of processing your request/request and it will be deleted no later than 2 months later (unless we have another legal reason for their retention).

The reason (legal basis) for this processing is usually:

- handling your request as a communication related to the request for the service we offer (we use this reason in accordance with Article 6 (1) (b) of the EU Regulation).

2.7. Records of lost and found items

If you apply for the release of a lost item or for the release of an item from the storage box if you lose the key to the box, we will record the following personal data about you:

• Name and surname
• Telephone number
• Abode
• ID number

These personal data are recorded for the purpose of proving to which person the items found were handed over, in accordance with Act No. 89/2012 Coll., the Civil Code, and in accordance with the Contractual Transport Terms and Conditions issued by the DT in accordance with Decree No. 175/2000 Coll., on the Transport Rules for Public Rail and Road Passenger Transport.

The reason (legal basis) for this processing is:

- compliance with a legal obligation (we use this reason in accordance with Article 6(1)(c) of the EU Regulation).

2.8. Accounting and taxes

We collect your identification and transaction data (in particular on monetary payments made, on canceled payments, on any refunds in the case of justified complaints) for the purpose of fulfilling our accounting and tax obligations imposed on us by applicable legislation (in particular the Accounting Act, the Value Added Tax Act, the Payment System Act).

These are the data that are listed on tax documents. Therefore, if a legal regulation obliges us to archive these documents, we also store your personal data, which must be stated on the documents.

Reason (legal basis) why we process the data:

- fulfillment of legal obligations (we use this reason in accordance with Article 6 (1) (c) of the EU Regulation).

2.9. Conclusion and performance of customer-supplier relationships

For the proper functioning of our Company, we need to enter into such customer-supplier relationships that are related to our business activities (e.g. fuel supply contracts, lease agreements, contracts for the provision of various types of services, contracts for the supply of parts for fleet repairs, contracts with tax advisors, legal advisors, etc.). For these purposes, we process only a minimal extent of personal data (if provided to us, then identification and contact information, such as name and surname, address, e-mail or telephone, or VAT ID of a natural person doing business), which are directly related to the concluded contractual relationship and its performance. In this context, we store personal data only for the duration of the contractual relationship (or for the fulfillment of legal obligations arising in particular from tax or accounting legislation).

The reason (legal basis) for this processing is:

- performance of the concluded contract (in accordance with Article 6(1)(b) of the EU Regulation).

2.10. Exercise (or defence) of rights

Should a dispute arise between the DT and you, we will process your personal data necessary to defend our legal claims in connection with the dispute until the end of the dispute. As a rule, in this context, we process basic identification data, data on payments made, data from complaint proceedings, data from mutual communication, data on legal steps taken and its results.

Reason (legal basis) why we process the data:

- the processing is necessary for the legitimate interests of our company in defending our claims (we use this reason in accordance with Article 6 (1) (f) of the EU Regulation).

3. HOW LONG DO WE KEEP YOUR DATA?

We process personal data for the minimum period for which we are obliged to process personal data. Specifically, this concerns the activities defined above (see point 2. Principles) for the following periods:

4. SOURCES OF PERSONAL DATA

We only process personal data that we have received from you or obtained when communicating with you. We do not search for and process personal data about you from public sources.

5. RECIPIENTS OF PERSONAL DATA

In principle, we manage your personal data within the DT and do not pass them on to third parties unless it is absolutely necessary.

Such a need may arise in the case of external suppliers/service providers such as:

- provider providing the Mobile Ticket (SMS) service

- providers of legal services (in the case of recovery of outstanding receivables arising from transport inspections)

- public procurement administrators

- auditors (audit of accounting documents).

In such a case, written contractual relationships are concluded with these entities (if they have the status of personal data processors) that contractually ensure the security of the transferred personal data in accordance with the EU Regulation. In principle, the registered office of IT service providers is located within the EU and personal data is not transferred outside the EU.

Some state administration bodies are entitled to request ad hoc information about you in order to fulfil their legal obligations (e.g. the Police of the Czech Republic, financial control authorities, the SAO, public procurement supervisory authorities). We only provide data if the right to request such data is required by law.

6. WHAT ARE YOUR RIGHTS?

Right of access to personal data

You have the right to access all processed personal data. At your request, we will provide a copy of the processed personal data in a machine-readable format.

Right to rectification of personal data

You have the right to have changed personal data corrected (or incorrectly disclosed data for any other reason). We will correct the changed data (e.g. from a new identity document).

Right to erasure of personal data

You have the right to erasure of your personal data that we would process unlawfully.

Right to restrict the processing of personal data

You have the right to block your personal data under the conditions set out in Article 18 of the EU Regulation (especially if an objection is raised, there is a dispute about the legitimacy of data processing).

Right to data portability

You have the right to obtain from us providing you with automated personal data in a structured, commonly used and machine-readable format, or to transfer this data to another controller, if technically feasible.

Right to withdraw consent

If you have given us your consent to process your personal data for specified purposes, you have the right to withdraw this consent at any time.

Right not to be subject to automated decision-making

You have the right not to be subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning you or significantly affects you. The DP does not carry out any such automated decision-making or profiling.

Right to object

You have the right to object if the processing is based on our legitimate interest.

Right to lodge a complaint

You have the right to address your complaint to the DT at any time, or to file a complaint with the Office for Personal Data Protection, address: registered office at Pplk. Sochora 27, 170 00 Prague 7 or to request judicial protection.

How to exercise rights

To exercise your rights listed above, please contact our Data Protection Officer – see point 1 of this Policy or you can exercise these rights in person when visiting DT. To exercise your rights, you can use the forms prepared by us located at www. dpmhk.cz in the section Personal Data Protection – here you will find a more detailed explanation of the conditions for exercising the right for each right.

We are obliged to inform you free of charge of the measures taken without undue delay and in any case within one month of receipt of the request. That period may be extended by a further two months, if necessary, taking into account the complexity and number of requests. If we do not comply with your request, we will inform you immediately (at the latest within one month) of the reasons for the non-compliance.

In some cases defined by legislation, we are not obliged to comply with the request in whole or in part. This will be the case, in particular, where the request is manifestly unfounded or excessive, in particular because it is repeated. In such cases, we may: (i) impose a reasonable fee taking into account administrative costs or (ii) refuse to comply with the request.

If we receive a request but have reasonable doubts about the identity of the sender of the request, we may ask you to provide additional information necessary to confirm your identity.